Maintain masking rules and security configuration
Rules define presentation; policies define applicable objects and identities. Creating a rule alone does not enforce it.
Create and reuse rules
- Open Security Policies > Masking Rules and create a folder.
- Create a rule using available types/properties.
- Verify purpose and expected presentation.
- Reference it in table/column policies and test actual access.
Referenced rules cannot be edited/deleted. Plan replacement against affected policies first.
Choose masking behavior
| Data | Verify |
|---|---|
| Identifiers | Required prefixes/suffixes and re-identification risk |
| Contact details | Minimum visibility for display/support/analysis |
| Amounts/dates | Statistical precision and ordering requirements |
| Fully hidden fields | No leakage through queries, exports, errors |
Use current algorithm names/parameters. Test null, Chinese, long, and invalid values on nonproduction data before policy use.
Maintain folders and references
Assign maintenance responsibilities. Use reference information for impact. Folder renames do not change execution but affect management/audit searches; record changes.
Understand Ranger synchronization
Enablement attempts policy synchronization, not guaranteed enforcement. Verify target objects, contents, failures, timing, and source mappings in Ranger before retrying.
Maintain in bulk
Import through More Actions. Export from All Masking Rules for all content, or select rows for partial export. Search by name. Nonempty folders cannot be deleted.
Configure codes and synchronization
In System Settings > Parameters, also labeled Parameter Settings, set information-item code generation or manual coding. Configure Ranger per source and verify target outcomes independently of the switch.
Read overviews and logs
Security overview covers published classifications, levels, systems, and departments, excluding unconfirmed/pending results. Operation logs trace administration; gateway audit traces SQL. See Gateway verification.